REMARKS 



Reconsideration of the application is respectfully requested. 

The claim amendments here are supported in the Specification as filed, at, for 
example, paragraphs [0013] - [0018] and Figs. 2-3. Accordingly, no new matter has 
been added. With claims 5, 23, and 31 being canceled, the claims pending upon entry of 
this amendment are 1-4, 6, 10-15, 19-22, 24, and 29. 

Claims Rejected Under 35 U.S.C. S103 

According to the Office Action, the independent claims 1, 10, and 19 are obvious 
under 35 U.S.C. §103 over U.S. Patent No. 6,263,348 issued to Kathrow, et al. 
("Katiirow") in view of U.S. Patent No. 5,809,230 issued to Pereira ("Perdra"). The 
rejection also refers to some aspects of the Microsoft NT operating system, as explained 
below. 

In particular, the Office Action argues that the Microsoft NT operating system 
teaches Applicants' claimed operation in claim 1 of generating ...a user identity value 
associated with a user identity . . . except that it does not teach the fact that the claim 
requires that the user identity value be generated by an application program running in a 
computer and that the identity value is associated with user identity that is authorized to 
change a system registry of the computer. Applicants respectfully submit therefore that the 
rejection is improper at the start, because it relies on a process for authenticating a user, 
to give the user access to a server. Although the user enters a password, and a client 
program hashes the password, this password must then be sent as a response to the 
server. It is then the server that compares the hashed password to stored values to find 
a match, and, if there is a match, then the user is allowed to access the server. 

Next, the Office Action looks to another reference, Kathrow, for teaching the 
generation of a registry security value associated with a system registry. This is in the context 
of the process in Kathrow which determines whether a file, such as a Windows system 
registry, has been modified. Kathrow describes a process to determine whether two 
files are different, by comparing hashed functions or fingerprints of them (instead of 
their contents explicitly). If they are different, then processing is halted. 
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Thus, the Microsoft NT operating system teachings and the teachings of Kathrow 
are separate requirements, one for authenticating a user and the other for determining 
whether a file has been modified. 

Next, the Office Action looks to Pereira which discloses an access control 
program that users an API to modify a system registry. In Pereira, the process is 
designed to control and limit access, by different users, to various resources in a 
computer. The access control program verifies whether a particular user is authorized 
for a particular, requested resource. There is a list of authorized resources for each user. 
This list is used to modify the system registry upon initialization, to identify only those 
programs which are authorized to be displayed to a particular user. [Pereira, col. 10, 
lines 29-33] Another program component monitors operating system file access calls, 
and verifies whether a given user is authorized to access a particular file. 

The teachings of the relied upon prior art can be again summarized as follows: 

The Microsoft NT operating system has a process for authenticating a user to 
give the user access to a server; Kathrow describes a process to determine whether two 
files are different; and Pereira describes how to control and limit access by different 
users to various resources in a computer. 

In contrast. Applicants' claim 1 has been amended to more clearly identify the 
invention relative to the prior art, by reciting a method to detect tampering with registry 
settings in a computer by an application program running in the computer. Each time a system 
registry setting is changed within the application by an authorized user, the registry security 
value is updated. When reading from the system registry, a new registry security value is 
generated and compared to the stored value to determine if processing should be allowed to 
continue. When monitoring the system registry for attempts to change it, the user is prompted 
for identify information and a new user identity value is generated which is compared to the 
stored value. In addition, a new registry security value is generated and compared with the 
stored value. Only if both of these new values match the stored values is the user allowed to 
make changes to the system registry. As the relied upon art references do not teach or 
suggest such a method for detecting tampering with registry systems, it is respectfully 
submitted that claim 1, as amended, is not obvious. 
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Independent claims 10 and 19 have been amended with limitations that are 
similar to those discussed above in support of the patentability of claim 1. Accordingly, 
those independent claims are submitted as not being obvious for at least the same 
reasons given above in support of claim 1. 

Any dependent claims not mentioned above are submitted as being neither 
anticipated or obvious, for at least the same reasons given above in support of their 
respective base claims. 

CONCLUSION 

In view of the foregoing, it is believed that all claims now pending patentably 
define the subject invention over the prior art of record and are in condition for 
allowance and such action is earnestly solicited at the earliest possible date. 

If necessary, the Commissioner is hereby authorized in this, concurrent and 
future replies, to charge payment or credit any overpayment to Deposit Account No. 02- 
2666 for any additional fees required under 37 C.F.R. §§ 1.16 or 1.17, particularly 
extension of time fees. 

Respectfully submitted, 

BLAKELY, SOKOLOFF, TAYLOR, & ZAFMAN LLP 
Dated: October 26. 2006 . By 




12400 Wilshire Boulevard 
Seventh Floor 

Los Angeles, California 90025 
(310) 207-3800 
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